Information Management Assessment

Medicines and Healthcare products Regulatory Agency Contents

Background 3

Report opinion 3

Executive summary (Inc. ratings and recommendations) 3

Highlights 6

Detailed findings of the assessment 7

Strategic planning and risk

Current IT systems and technical change

Control and oversight of current practice

Compliance

Annex – Recommendations with proposed supporting 17

Actions

© Crown copyright 2019

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gov.uk Background

- The National Archives' Information Management Assessment (IMA) programme was set up to review standards of information and records management in government organisations.

- At the request of the Medicines and Healthcare products Regulatory Agency (MHRA) The National Archives carried out an IMA involving a detailed review of supporting documentation provided by the Agency and interviews with senior staff, specialists and practitioners. These were held in the agency’s offices in London between 8 and 11 July 2019.

- This report provides a summary of the good practice and risks we identified, focussing on the most significant findings.

Report opinion

| Assurance rating | Opinion | |------------------|---------| | Amber | • MHRA has put in place the building blocks of an information management framework that has the potential to mature to support business efficiency, effectiveness and greater knowledge sharing as well as compliance with General Data Protection Regulations (GDPR) and Freedom of Information (FOI).\
• MHRA needs to ensure the historic public record can be readily identified and transferred to The National Archives to achieve compliance with the Public Records Act. |

Executive summary

MHRA is an Agency comprised of four formerly separate organisations, with the last merger occurring in 2013. With each merger the Agency has gained a significantly wider remit, as well as more staff and more information. As a regulatory and scientific organisation, the Agency acquires, generates and retains a lot of complex information as evidence. Due to its organisational history this information is spread across a number of systems, document repositories and paper stores. It is a considerable task to apply an information management framework to such a varied and vast amount of information.

The Agency’s corporate Knowledge and Information Management (KIM) function was only established in 2015 and to its credit the team, which is still growing, has put in place a governance structure to provide the basis for good Information Management. The Agency now has an Information Asset Register (IAR) and each division or centre has at least one senior Information Asset Owner. Crucial documents such as the retention and disposal policy have been agreed. The Agency has also rolled out Office 365 (O365), moving the Agency largely away from shared drives into SharePoint Online. This project was known as the Digital Workplace Programme which kicked off an Agency wide programme of Operational Transformation. This is a five year programme (2018–2023) which seeks to transform the way the agency works, breakdown siloes and replace legacy systems with cloud based solutions that meet user needs. The Data, Knowledge and Information Management (DKIM) team is part of the division which is leading this transformation. It is incredibly well placed to make sure knowledge and information management is at the heart of this transformation. The Operational Transformation programme and by proxy the Information Management agenda has crucial senior support and buy in at the very top of the agency. The DKIM team must take advantage of this and ensure that the information management maturity of the Agency grows with its transformation.

There are ten areas of focus in the assessment that cover a range of strategic issues. The table below identifies MHRAs performance ratings across these areas.

| | Identification of Information Management Risk | Satisfactory | |---|-----------------------------------------------|--------------| | 2 | Response to Technical Change | Satisfactory | | 3 | Defining Roles and Establishing Governance Structures | Satisfactory | | 4 | Policy and Guidance | Approaching Satisfactory | | 5 | Improving Information Management Capability | Approaching Satisfactory | | 6 | Controlling and Exploiting Legacy Information | Development Area | | 7 | IT Systems and Tools | Development Area | | 8 | Monitoring Performance | Development Area | | 9 | Appraisal, Selection and Sensitivity Review process | Priority Risk Area | | 10| Transfer to TNA | Priority Risk Area |

Based on analysis of the evidence under each area, the report highlights a number of issues that if addressed will improve information management at MHRA. Foremost, the Agency is currently in breach of the Public Records Act. It needs to act urgently to gain legal cover from the Advisory Council on National Records and Archives for its significant legacy holdings. The Agency needs to begin the process of appraising, selecting, sensitivity-reviewing and transferring public records to The National Archives. The day-to-day management of paper records still resides outside the DKIM team for historical reasons, it is essential that this responsibility is formally moved to the DKIM team going forward. MHRA also needs to focus on strengthening the impact of its Information Asset Owner and Custodian network and continue to work to change the ‘keep everything forever’ culture which still exists in pockets of the agency so that it truly complies with its own retention and disposal policy.

Based on the evidence gathered during the assessment, the report makes the recommendations outlined in the summary below. These should be addressed through the creation of an IMA action plan and/or a robust information management strategy. This will support delivery through to the formal IMA progress review conducted by The National Archives (due early 2021). Recommendations are identified as having either a high (H), medium (M) or a low (L) priority:

| Recommendations | Priority | |--------------------------------------------------------------------------------|----------| | 1. Develop and publish a methodology for appraising and selecting historic public records in consultation with the Strategic Compliance team at The National Archives. | H | | 2. Develop a process for sensitivity-reviewing paper and digital records prior to transfer to The National Archives. | H | | 3. Put in place resource to enable the DKIM team to take over the management of the paper storage contract and begin transferring records to The National Archives to achieve compliance with the Public Records Act. Resourcing should be adequate to support not only the existing management of paper records, but also to enable the agency to address the backlog of transfers, and to enable future digital transfer to National Archives. | H | | 4. Improve communications and distribution of resources between the central DKIM team and Information Governance roles in the National Institute for Biological Standards and Control (NIBSC) and Clinical Practice Research Datalink (CPRD). Consider increasing the presence of KIM specialists at NIBSC. | H | | 5. Further develop the yearly Information Assurance Reporting process and consider expanding the role of the Information Custodians to aid monitoring of compliance with information management best practice. | M | | 6. Finalise MHRA's five year information management plan and report progress to the Corporate Executive Team for top down support. | M | | 7. Make improvements to SharePoint Online, in particular ensuring Information Management functionality is rolled out across SharePoint Online and users are aware of any actions they need to take. | M | | 8. Ensure KIM team are resourced to play an active role in the procurement and/or development of new systems and migration to those systems as part of the Operational Transformation (OT) programme. | L | | 9. Improve training offer by making specific IM training available to staff at induction, and providing additional training for those in IAO/Information Custodian and Site Content Owner roles. | L |

## Highlights

The following are among the effective approaches identified in the course of the MHRA IMA, which other government organisations may find helpful:

| Summary of good practice approaches identified | |-----------------------------------------------| | **Improving Information Management Capability** | The Transformation Director is a qualified Information Professional who has had the advantage of building an information management function from scratch to suit the current needs of the organisation. The team have recruited people with specific skills relevant to the problems at hand (for example Office 365 rollout). They are considerably aided by having data analyst and taxonomy specialists (a great example of the types of role required in modern IM teams) in their immediate department that they can call on and are working hand in hand with the Data Protection Officer and Information Security professionals. The multi-disciplinary team is evidence of the way the Agency has brought together the entire information lifecycle. | | **Controlling and exploiting legacy information & Technological change** | The DKIM team are part of a transformation programme that has information flow and user needs at its centre. The Operational Transformation (OT) programme recognises that legacy systems are more than a security and continuity risk and that they are preventing innovation and reinforcing siloed ways of working. The OT programme also realises the value of long held knowledge residing out in the organisation and seeks to capture and exploit this. This is due to the fact that the OT programme is being delivered by the Chief Digital Information Officer and SIRO, whose seat on the Corporate Executive Team ensures that there is senior awareness of the programme and that it is part of the wider Corporate Strategy. | | **Defining roles and establishing governance structures & Identification of Information Management Risk** | As mentioned above, the team and their Director have made sensible decisions in laying the foundations for an information management framework by establishing Information Asset Owners (IAOs) and helping them to fill out a comprehensive IAR linked to a Retention and Disposal Policy which they also fed into. They have ensured the IAOs are accountable for their assets through the annual Information Assurance reporting process which is directed to the SIRO who in turn reports to the CET. | Detailed findings of the assessment

1 Strategic planning and risk

| 1.1 Improving information management capability | Rating: Approaching Satisfactory | |------------------------------------------------|----------------------------------| | • MHRA has all the building blocks in place to build information management capability within the Agency. It has dedicated resources and expertise, a governance framework and published policy and procedure documents. | | • The National Archives has seen a draft of the DKIM five year plan. The DKIM team should prioritise the development of this and make sure it is clear, achievable and aligned with the wider Operational Transformation (OT) programme/strategy. The five year strategy is centred on a sound visualisation of the information lifecycle. It has people at the centre encircled by ‘create’, ‘use’ and ‘store’ with a further outer all-encompassing circle called ‘govern’. The team should keep the Corporate Executive Team (CET) informed of progress and seek top down support where necessary. See Recommendation 6. | | • The work the DKIM team have done in raising awareness of data protection, information and cyber security and improving the agency’s performance was well regarded and understood amongst interviewees. There is crucial awareness that patients’ lives are at stake if the information the agency receives and creates is poorly managed or compromised. The DKIM team now needs to build on this and change attitudes towards retaining and duplicating information. They need to make sure that the agency understands the inherent risk in not having a robust approach to disposal. It should use the recent experiences of frustrating search and discovery exercises necessitated by public inquiries and other investigations and the likelihood of the agency being subject to similar rule 9 requests in the future to drive this message home. The agency needs to move from a ‘keep everything forever’ culture and become accustomed to making risk based decisions on where and for how long it retains particular sets of records. The agency also needs to become accustomed to the idea that records can be kept for historical as well as evidential purposes. |

| 1.2 Controlling legacy information | Rating: Development Area | |-----------------------------------|--------------------------| | • The DKIM team have already started to take control of their legacy information. The have consolidated the paper holdings of the regulatory centre with legacy records held by the Department of Health and Social Care (DHSC) and improved the listing of the paper files (see section 4.1). With regards to digital information, through the Digital Workplace programme, the agency has largely moved off shared drives into SharePoint Online. Not everything was migrated wholesale to SharePoint Online sites, teams were given the chance to review their shared drive folders and do a tidy/cleanse prior to migration. The head of DKIM estimates that this resulted in a reduction of 65% at the point of migration. Legacy Finance and HR systems have also been replaced. | • MHRA is made up of nine divisions and two centres. While there is some crossover, most divisions and each centre have multiple legacy systems through which they acquire, process and add to the information that is fundamental to their workflows and processes. Many of these systems are also heavily customised and inter-dependent. Rationalising and upgrading these legacy systems is a primary driver for the Operational Transformation (OT) programme and many divisions are running business as usual improvements to these systems in parallel to the wider OT programme. Due to the age of some of these systems they do not meet current user needs. We heard that users often work out of shared drives before saving into systems as an efficiency workaround. The role of the KIM team in the move from legacy to new technology is two-fold:

1. Every time a repository is decommissioned or migrated encourage the business owners to identify what information needs to be migrated and what can be disposed of and where the business critical and historically important information is ensuring the IAR is updated.
2. Ensure that new systems have retention and disposal functionality built in or added to off-the-shelf products. Ensure that new systems really meet user needs so that information is not kept off-system in personal or other unofficial areas which will compromise the efficacy of IARs and the current e-discovery process for finding information across repositories.

• See Recommendation 8.

The migration to new systems will be a great driver for rationalising the digital information the agency is holding, testing the retention and disposal policy and embedding better information management behaviours with the rollout of new technology. When end user needs are being considered the KIM team should make their voice heard but it will require careful resourcing to ensure KIM can be represented across all projects. Where they can, KIM should align their agenda with others in the transformation directorate and have, for example, change champions or an equivalent role, advocate on their behalf.

• Even if the Agency is successful at rationalising their legacy information and begins to take bolder disposal decisions, there will remain a legitimate collection of legacy information needed for ongoing business use and regulatory/legal purposes. The KIM team should feed into where and how this information is stored so that it can be searched if necessary and digital continuity checks can be periodically undertaken. Legacy digital information within the agency has already become a casualty of past migrations and there are orphaned collections of files and data and instances where old paper records have been scanned in and added to ongoing case files but are not as searchable as newly added information. The Agency needs to be mindful of the risk of adding to this when it undertakes big migrations as part of the OT programme. The role for the KIM team will be to keep an eye out for information which is side-lined and falls through the gaps of big migrations. For example, there is already a significant amount of information still stored on shared drives as it is unsuitable to move into SharePoint Online (mostly NIBSC scientific datasets), which the DKIM team still need to find a solution to. See Recommendation 8. • MHRA currently operates a 30 day retention policy for inboxes and OneDrive after a colleague leaves the organisation. During this period, line managers have access and can move any information into shared libraries that is of ongoing value. Providing IT are alerted to leavers and line managers are pro-active in managing the leavers process, the agency is performing well in this area rather than sitting on a growing risk of orphaned personal accounts.

1.3 Identifying information management risks

| Rating: Satisfactory | |----------------------|

• There was a good awareness across interviewees of the information management risk carried by the department. Information Governance is discussed at Corporate Executive Team and ARAC meetings. Nine divisions reported that information risks were included in their divisional risk registers in last year's Information Assurance reports. The DKIM team are planning on putting together workshops for the Information Asset Owners around identifying information management risks so that they are better equipped to recognise, mitigate, report on and escalate risks. The five year plan should also include a distilled description of the Information Management Risk the agency is carrying and how the implementation of the plan will reduce this risk. See Recommendation 5.

2 Current IT systems and technical change

2.1 IT systems and tools

| Rating: Development Area | |--------------------------|

Move to SharePoint Online

While there are understandably some users who struggle with the switch from shared drives to SharePoint Online and sharing via links, the Office 365 environment is appreciated throughout the agency for the ease with which colleagues can work within their own and shared mailboxes, OneDrive and divisional SharePoint Online site/library. Many users are also making good use of Delve. In fact, the move to SharePoint Online is synonymous in people's minds with the perceptible recent improvements in information management within the agency. The DKIM team used ShareGate to manage the migration from shared drives to SharePoint Online and are confident that the last modified dates were retained.

Document sharing and collaborating

Sharing across divisional and centre boundaries is not so easy. The default access model is not open enough and as such users are sending attachments rather than links to colleagues outside of their immediate teams. They are also unable to see what other information the rest of the agency is generating. This is not good for enhancing knowledge management within an already siloed organisation. See Recommendation 7.

Currently when a user is sent a link they don't have permission to access, the access denied page that is returned to them lacks a 'request permission from document owner’ button. There are pockets of cross agency collaboration using sites/libraries specifically set up for that purpose or via the ‘agency’ folder which is deliberately defaulted to open to everyone. For individual document permissions this could be made easier by having a request permission button and also by establishing clearer permissions management. Currently a lot of users send requests to IT rather than the Site/content owner, presumably because they don’t know who holds that role or because the role holder has not been responsive in the past. Improvements in this area would also stop the sharing of password protected attachments which can be troublesome from a digital continuity perspective. The DKIM team are aware that the permissions situation needs improving and are committed to revising this, The National Archives fully endorses this. See Recommendations 7 and 9.

Training and guidance

Staff are used to publishing SOPs and policies on the agency’s intranet INsite, this is established good practice. However we heard numerous complaints that INsite is not user friendly, so whilst people know that’s where they should look and don’t doubt that the information is there, they rarely go looking for it.

The digital workplace programme which delivered migration to O365 along with new laptops to the business was clearly a success however the communications and training on how to use O365 and get the best out of the technology could bear repeating now, not least for new users who were not in post during the digital workplace programme (see section 3.2). We also spoke to users who are acutely aware that with some SharePoint Online development expertise they could be using SharePoint Online as more than a document repository, using it to facilitate their workflows and processes e.g. a workflow for signing off SOPs for the policies and procedures committee or ISO 9001 certification Quality Documents. The DKIM team are aware that they could be exploiting O365 more and have plans for continuous improvement e.g. via their planned O365 centre of excellence. See Recommendations 7 and 9.

Information Management in Office 365

MHRA now faces the same dilemma as everyone else – how to facilitate information management in a way that doesn’t impede ease of use. The agency is implementing retention in SharePoint Online using out of the box content-types and has rolled out Records365 across some libraries. The default content-type is ‘ephemera’, which has a two year retention attached to it. We heard multiple times across the interviews that users were not changing this and that even if they were inclined to, they couldn’t always identify a more relevant content-type. Some users were not aware of having to choose a content-type, despite receiving training on this during the Digital Workplace Programme, so were presumably defaulting to ‘ephemera’.

There is a plug-in that allows users to save emails into SharePoint Online libraries and we saw evidence during our interviews that this was happening, but this is patchy as in most organisations. We also noted a number of instances of users saying that they were keeping copies in their inbox/shared mailbox folders as well as in SharePoint Online as a backup. This is symptomatic of the wider reticence within the agency towards disposing of information. Deliberate duplication is something the KIM team should crackdown on.

A couple of users mentioned to us that they had to manually switch on auto-save, This seems more likely to be a lack of understanding which is symptomatic of users still getting used to SharePoint/O365 which the KIM team needs to remain cognisant of when they move forward with plans in this space. See recommendation 7 and 9.

Search and discovery

At present the SharePoint Online environment combined with the amount of content stored means that users can find what they are looking for with relative ease via search or knowledge of their own filing structures. The DKIM Team are also working on a taxonomy to deploy via tagging in SharePoint Online to aid search retrieval. This is a great idea and it would be good to expand it to other systems such as Documentum going forward.

Monitoring, analysis and moving forward

Before the KIM teams embark on a new phase of engagement around O365/SharePoint Online, they are aware they need to properly assess how the platform is being used currently, for example they are currently acquiring the stats for OneDrive and Exchange usage and the distribution of content-types to see if this is this what they would expect to see or if the trends are worrying from an IM perspective. The team might consider surveying O365 users via the Information Asset Custodian network to get additional user feedback to inform future planning.

They also need to move ahead with their planned explore phase into whether to continue to use E3 and content-types with RecordPoint on top or to switch to E5 and make use of auto-labelling for records and assigning retention policies that way. Once these two pieces of work are concluded the KIM team will be in a good place to put together a plan for improving information management behaviours within O365. We know from our interviews with the DKIM and IT team that they have thought about these elements already which is great to see. See Recommendations 7 and 9.

See section 1.2 for legacy systems in use at MHRA outside of SharePoint Online and how the agency is mitigating risk via the OT programme.

In most cases users were very clear on what information they should be keeping and in which system (whether this is the right assumption moving forward is another matter) but we noticed a particular overlap between SharePoint Online and Documentum. Documentum also seems to have a much more open access model which is at odds with the permissions in SharePoint Online and this maybe the reason it is favoured over SharePoint. It is hard to know the extent of this from our interviews so this should form one of the survey questions for business areas using Documentum. See Recommendation 7. 2.2 Technological change

| Rating: Satisfactory | |----------------------|

- The DKIM team led the Digital Workplace programme which introduced O365 and new laptops to the agency in 2018. There is good evidence that information management is being factored into existing technology change and decommissioning processes at MHRA, with members of the DKIM team attending the Triage, Change and Solution Design boards and feeding into discussions and assessments. This influence needs to be extended to the high profile procurements of brand new technology/systems as the OT programme moves forward.

3 Control and oversight of current practice

3.1 Defining roles and establishing governance structures

| Rating: Satisfactory | |----------------------|

- KIM is well placed within the DKIM department in the Transformation Division at MHRA. It has good links into the related areas of information and cyber security, data analysis and taxonomy and is actively supported by the SIRO and Chief Digital Information Officer who is also the Divisional Director (see highlights table at the beginning of the report).

- While it is an advantage that the DKIM team are part of the division responsible for delivering the OT programme, this means they are also subject to inevitable change backlash. The DKIM team should think about how they want to brand themselves going forward as they will remain a corporate function long after the OT programme has delivered (currently slated to wind up by 2023).

- The KIM team have achieved good visibility within MHRA and are known for operating a quasi-consultation service; being helpful, responsive and open to change in trying to improve user's working lives. There is a question about the sustainability of this approach in terms of resource which may impact the team's ability to step back and look at things strategically. If the KIM team are going to: a. maintain the level of 1-2-1 advice, particularly to IAOs b. be across all the IT change and migrations that happen as part of OT (see section 1.2) c. put in place processes for appraisal, selection, sensitivity review and transfer to The National Archives (see sections 4.1 and 4.2) d. takeover the management of the contract for the paper store (See 4.1) e. Rollout Records365/equivalent IM functionality in SharePoint Online (see section 2.1) f. improve information management behaviours across the agency via training, etc. (see section 3.2) g. expand the yearly assurance reporting process (see section 3.3) h. complete the DKIM plan and appraisal methodology (see section 1.1, 4.1)

As well as engaging in day-to-day BAU and unpredictable occurrences such as future inquiries or breach investigations, they are going to need additional resources. The Head of the DKIM team is aware of this and is planning in upping the current level of resources which The National Archives fully endorses. See Recommendations 8 and 3. • The DKIM team currently reaches into the business via its network of Information Asset Owners (IAOs) who also meet quarterly as the Information Asset Board, chaired by the SIRO/CDIO/Transformation Director. The IAOs were originally set at deputy director level but some roles have been delegated due to time pressures. There is nothing wrong with delegating some of the responsibilities of the IAO role to individuals who are well placed to carry them out but overall responsibility and sign off should be maintained at deputy director level. We also interviewed one new IAO who had been given no training or formal guidance on the role, it seems that the DKIM team assumed the former holder of the role would pass that down and the former IAO assumed the DKIM team would do this. Outside of the IAB quarterly meetings which are formal in nature, the IAOs don't seem to have much contact and are missing the opportunities of forming a network that shares issues and best practice.

• The IAOs are supported by Information Custodians, although the Information Custodian role is less well defined and its existence is patchy across the divisions and centres. The IAO role is working well as a high level Information Governance role, firmly placing responsibility within the divisions and centres. The Information Custodian role could be further developed into a policing/monitoring role so that where poor information management practice is identified it is challenged, improvements noted or continuing poor practice escalated to the IAO and/or KIM team. The gap identified above could be filled by a network of Information Custodians working to share knowledge across the agency, The DKIM team has started to set up this network which The National Archives fully supports. See Recommendation 5.

• During the digital workplace programme the Single Point of Contact Role (SPOC) was established within teams to provide support in the transition from shared drives to SharePoint Online. Some of the SPOCs became Information Custodians but some didn't. End users interviewed often did not know who their IAO, IC or SharePoint Online content owner was. It would be worth looking at putting posters together for these three roles with photos and descriptions of the roles in the team areas to raise awareness and provide clarity, the roles and their occupants should also be mentioned in the induction process for new starters. See Recommendation 9.

• CPRD and NIBSC have their own small Information Governance resource which has remained since they merged with the agency. There is a tension between how information management solutions that are designed within the regulatory centre take account of the differences in technology and working practices in NIBSC and CPRD and how well they are communicated. CPRD and NIBSC have separate functions within the agency and NIBSC occupy a different physical site. It might be advisable for the DKIM team within the regulatory centre to put in place more regular communications with CPRD and NIBSC so that each is clear on what is expected in terms of roles, responsibilities and service delivery. See Recommendation 4.

• Linked to the above paragraph on resourcing, the resource at NIBSC is currently extremely stretched with one person carrying out a myriad of corporate functions. Whether an additional Information Manager post is funded at NIBSC or resource is dedicated from the centre, something needs to change as despite best endeavours on all sides the IM maturity of NIBSC is not going to improve with current resourcing levels. See Recommendation 4. 3.2 Promoting policy and guidance

- MHRA’s policies and guidance are comprehensive and available on the intranet and a dedicated SharePoint Online Site. It was apparent during our interviews that despite the availability and comprehensiveness of this resource, a significant number of users are simply not aware of or are ignoring these resources (see section 2.1 above in relation to the intranet). The DKIM team should communicate to users the distinction between the content available on Knowledge Hub (their SharePoint site) which is training material and the policies and guidance which sit on their intranet site INSite, or consider duplicating the policy and guidance on the Knowledge hub so that users only have to go to one place. Any communication should reiterate that training is regularly available as many interviewees gave the impression that training was only delivered during rollout and not currently available. With regards to O365 the KIM team are not making use of Microsoft’s owning training materials which are comprehensive and intended for all end users and may reduce the need for creating bespoke content. See Recommendation 9.

- Linked with the above point in section 3.1 around establishing their ‘brand’, the KIM team need to think about how they want to communicate to staff long term. Things to focus on include: their part in the induction process, their training programme for IAOs, Information Custodians and SharePoint Online Content Owners and what regular messages those role holders are imparting to business units. Initiatives such as the ‘New Year’s Inforesolutions’, and ‘ask the KIM team days’, are to be applauded but no end users interviewed could recall a recent campaign by the KIM team although many IAOs and other interviewees’ spoke highly of the bespoke advice they had received and the training that they had previously undertaken on Information Security and working in SharePoint Online. This is illustrative of the way the KIM team is currently interacting with the business.

3.3 Monitoring current practice

- IAOs complete an information assurance report for the SIRO each year and in turn the SIRO produces an overall report for the CET. The purpose of the IAO reports is to provide assurance or identify gaps in information governance arrangements and to outline the current information risks faced by the divisions and the steps taken to mitigate them. As part of the process, the IAOs are also asked to review their entries in the IAR, Records of Personal Data Processing and Retention and Disposal Schedule to ensure that all are accurate and up to date. There continues to be an emphasis on unstructured information being captured in the IAR, with an expectation that structured information in databases is being managed centrally and is not the responsibility of the IAOs within the divisions and centres. NIBSC’ entry on the IAR is particularly sparse and we noted that Finance and Procurement have failed to engage with the reporting process entirely.

- All the IAOs that we interviewed said more could be done to improve the communication of the reports outside of the Information Asset Board. No end users interviewed or Directors were aware of ‘how well’ their division fared in the yearly reporting process. As the reporting process takes place at the end of the financial year we got the impression that it is seen as just another end of year report.

- Now that the yearly reporting process has been established, the DKIM team need to consider how to broaden the reporting process so that it encompasses more elements of information management. As well as engendering responsibility for and raising awareness of Information risk in the business, the team should consider using the process to rate departments and drive real improvements in information management. They could also seek to monitor progress and pinpoint those divisions who are standing still and not continuously improving. The DKIM team may benefit from talking to other organisations who do this well by focussing on other elements of self-assessment e.g. filing habits (such as how often moving important emails are moved into shared areas) and adherence to file naming conventions. This type of self-assessment could fit well with an expanded Information Custodian role, as described above, carrying out spot checks on the aforementioned areas or existing elements of the reporting process such as disposal actions. See Recommendation 56.

- See section 2.1 for how monitoring of O365 can be improved. The National Archives strongly recommends that dashboard statistics from O365 and other systems are fed into the reporting process so that it is strengthened by this type of quantitative data.

- It would be helpful to allow divisions and centres to benchmark themselves against each other, (whether based on self-assessment or statistics from the O365 dashboard) and this may make the report resonate more with Directors and other stakeholders. Where the DKIM team suspect self-assessment is too generous or not based on thorough knowledge/checking, this should be methodically investigated. It may be advisable to do mini quarterly reports to drive continuous improvement. The completed information management five year plan should set out the intention in this space. The DKIM team should also use the reporting process to gain feedback from Information Custodians about how they can better support them to an improved rating in future. See Recommendation 5.

4 Compliance

| 4.1 Transfer to The National Archives | Rating: Priority Risk Area | |--------------------------------------|---------------------------|

- MHRA have not yet transferred records to The National Archives. The agency is currently in breach of the Public Records Act. In the first instance MHRA should submit a paper to the Advisory Council on National Records and Archives (ACNRA) to apply for a retention instrument to cover their legacy paper holdings. The paper should include a proposed plan for how the agency plans to process their backlog for transfer. The DRO has a plan to undertake a transfer pilot imminently, focussing on classes of records that were historically transferred by the Department of Health before machinery of government changes. The National Archives is fully supportive of this and likewise will work with the DRO to put together a paper for the ACNRA. See Recommendation 3. • Going forward MHRA will need to build on the pilot project and put in place resource to clear their paper records backlog through a regular programme of transfer agreed with The National Archives, and to apply for administrative retentions for records that the agency needs to retain for longer than 20 years for regulatory purposes. See Recommendation 3.

• With the advent of the 20 year rule, many departments and agencies undertook a discovery process to truly understand the extent of their legacy holdings. The National Archives would recommend that the agency do this also. MHRA have already taken the positive step of taking ownership of legacy records held by the Department of Health and Social Care, but it would be prudent to get each division and centre to do a root and branch search for any paper files still out in the business so the DKIM team have a proper understanding of their paper records holdings. See Recommendation 3.

• Historically, the contract for the agency's main paper store has been managed by the Policy Division. That division has also been responsible for the recall of records and approving additions to the repository. The National Archives recommends that this contract and day-to-day operations are now moved to the KIM team within the Transformation Division so that all information can be managed centrally and they can better manage transfer to The National Archives. See Recommendation 3.

4.2 Appraisal, selection and sensitivity review process

| Rating: Priority Risk Area | |---------------------------|

• MHRA should act now to provide a basis for selection decisions and a basis for the preservation of records with historical value. As part of the pilot transfer, we strongly recommend that MHRA develop a methodology for appraisal and selection. We understand work on this has already begun and there is a draft version. The National Archives will be happy to work with the agency on this and would recommend the final document be published to the agency's GOV.UK pages to aid transparency. This document and its publication will be very useful for the agency if they face future scrutiny of their record-keeping by a public inquiry or similar. The methodology should be a natural extension of the agency's retention and disposal policy and be in sync with its IAR. The agency should keep a record of all disposal decisions internally for their own audit purposes, watching out for consistency in decision-making and recognising when either the appraisal methodology or the retention and disposal policy need to be updated. See Recommendation 1.

• The agency may find it useful to consult with their parent department and other DHSC Arms-Length Bodies when developing their sensitivity review process. We heard that the DKIM team intend to use their data analyst to curate a list of sensitive and significant terms as a way of semi-automating sensitivity review and selection in future. The National Archives is very supportive of this proposed approach. See Recommendation 2. At present MHRA are acutely aware of their paper legacy but they should also be aware of the fact that they will also have born digital records that are due for transfer and they should bear this in mind when they are developing their processes. MHRA board minutes and other important information is published on GOV.UK, so this will already be captured in The National Archive's web archive.

Annex – Recommendations with proposed supporting actions

| Recommendation 1 | priority | |------------------|----------| | Develop and publish a methodology for appraising and selecting historic public records in consultation with the Strategic Compliance team at The National Archives. | H |

This would be supported by:

- Working with stakeholders to identify paper and digital information with likely historical value.
- Publish the resulting document on MHRA’s GOV.UK pages to ensure transparency.
- Reflect the document in the agency's Retention and Disposal policy and IAR.

| Recommendation 2 | priority | |------------------|----------| | Develop a process for sensitivity-reviewing paper and digital records prior to transfer to The National Archives. | H |

This would be supported by:

- Working with stakeholders to identify paper and digital information with likely historical value.
- Publish the resulting document on MHRA’s GOV.UK pages to ensure transparency.
- Reflect the document in the agency's Retention and Disposal policy and IAR.

| Recommendation 3 | priority | |------------------|----------| | Put in place resource to enable the DKIM team to take over the management of the paper storage contract and begin transferring records to The National Archives to achieve compliance with the Public Records Act. Resourcing should be adequate to support not only the existing management of paper records, but also to enable the agency to address the backlog of transfers, and to enable future digital transfer to National Archives. | H |

This would be supported by:

- Applying to the Advisory Council on National Records and Archives for an administrative retention instrument to cover paper and potentially digital records backlog – The National Archives’ Strategic Compliance team will support with this.
- Managing the internal transfer of the Iron Mountain contract from Policy to Transformation Division.
- Asking divisions and centres to do a root and branch search for paper files.
- Carrying out pilot transfer as planned and working through any issues with The National Archives’ transfer team and then planning for future transfers once resource implications are understood. | Recommendation 4 | priority | |------------------|----------| | Improve communications between the central DKIM team and Information Governance roles in the National Institute for Biological Standards and Control (NIBSC) and Clinical Practice Research Datalink (CPRD). Consider increasing the presence of KIM specialists at NIBSC. | H |

**This would be supported by:**

- NIBSC and CPRD independently considering and stating their requirements to the DKIM team.
- The process should assess if the current resource is sufficient, especially considering the situation on the ground at NIBSC.

| Recommendation 5 | priority | |------------------|----------| | Further develop the yearly Information Assurance Reporting process and consider expanding the role of the Information Custodians to aid monitoring of compliance with information management best practice. | M |

**This would be supported by:**

- Further developing the role of Information Custodians to target poor practice and encourage a network that meets regularly or collaborates online to share lessons learned and best practice tips.
- Integrating metrics from the O365 dashboard and potentially other systems to provide evidence for how divisions are performing.
- Consider asking a question set, a level below, what is being asked now to cover things like compliance with naming conventions and saving emails to SharePoint Online libraries.
- Consider how the reporting process can be more widely communicated outside of the Information Assurance Board potentially by benchmarking divisions against each other to encourage friendly competition.
- As part of the monitoring process make sure the KIM team continues to ask how they can better support the IAO/IC in the future.
- Ensure the IAO role and accountability remains at Deputy Director Level.

| Recommendation 6 | priority | |------------------|----------| | Finalise MHRA’s five year information management plan and report progress to Corporate Executive Team for top down support. | M |

**This would be supported by:**

- Giving particular emphasis to securing the historic public record of the agency.
- Setting out how the department will tackle technical and cultural barriers to good information management.

| Recommendation 7 | priority | |------------------|----------| | Make improvements to SharePoint Online, in particular ensuring Information Management functionality is rolled out across SharePoint Online and users are aware of any actions they need to take. | M |

**This would be supported by:**

- Weighing up the cost/benefit of using Records365 or upgrading to E5 licences to take advantage of record labelling and retention policy functionality. • Understanding current user behaviour with regards to content-type application and ensure correct retention periods are applied going forward, how will depend on the direction set by resolution of the above point. • Develop training and guidance on any user actions needed and communicate changes to users. • To ensure interoperability, upgrade NIBSCs’ SharePoint Online to the same version being used by the rest of the Agency. • Conduct an agency wide user survey on SharePoint Online usage. Use findings to identify and prioritise improvements needed to the current set up or where guidance/training is needed. Use the survey to look at the issue of duplication and/or confusion of where to save information with regards to Documentum and SharePoint Online and Shared inboxes and SharePoint Online. • Put in place a process/mechanism to ensure permissions requests are sent to Site Content Owners instead of the IT helpdesk. Ensure sites have a clear landing page and role holders, in particular Site Content Owners are listed in the description. The permission denied page should let users request access and notify the document owner and Site Content Owner of the request. Ensure communications are put out around this and it is included in relevant guidance and training.

Recommendation 8

| Ensure KIM team are resourced to play an active role in the procurement and/or development of new systems and migration to those systems as part of the Operational Transformation (OT) programme. | priority | |---|---| | L |

This would be supported by:

• The KIM team being involved in the OT timetable/roadmap and planning who within the KIM team will be involved in which projects and how they will balance this with their other priorities. If there are not enough people within the team for this to be possible they should advocate for additional information manager post(s) on a project basis, who will also be able to help the team deliver the remainder of these recommendations. This will allow the team to: • Continue to advocate for retention and automated disposal functionality to be part of new systems • Be part of migration planning and advocating for legacy information to be disposed of where possible and ensure that information that is migrated is not corrupted and remains accessible. • Ensure they have a comprehensive knowledge of all repositories of legacy (and potentially orphaned) information as the agency progresses through the OT programme. If the KIM team remains properly embedded in the decommissioning and migrating of information from legacy to new systems, they will be able to catch any information that falls through the gaps.

Recommendation 9

| Improve training offer by making specific IM training available to staff at induction, and providing additional training for those in IAO/Information Custodian and Site Content Owner roles. | priority | |---|---| | L |

This would be supported by:

• Putting all information management training and guidance resources in one place or wholesale duplicated them on the Knowledge Hub so users can access the whole resource in one place. • Consider complimenting mandatory Responsible for Information training and IT induction process with additional information management training such as how to use SharePoint Online and what to save in shared areas. • Linked with Recommendation 6, once IAO and Information Custodian roles are further defined consider what training the role holders should receive to support them in their roles such as the already planned Information Risk workshops. • Repeat training and communications on using and getting the most out of O365 that were successful during the Digital Workplace Programme, incorporate new guidance on how to apply retention as per Recommendation 7. • Consider surveying users so that O365 training and guidance can be shaped to meet user needs and individual use cases for developing SharePoint Online workflows can be gathered and evaluated. See above, Recommendation 7. It maybe that representatives from different business units would benefit from some advanced O365 training in order to gain an overview of the potential use cases for the technology, this would help them formulate their user needs for the KIM team.